Follow your University's Reporting Protocol
Most Universities, as well as most businesses, government agencies, non-profit organizations, and organized religions, have established protocols to help you through this reporting process and, generally, to ensure some combination of proper and timely handling of the issue, image protection, protection against attempts at retaliation towards whistleblowers, and protection against people being accused of things without basis.
For example, Humboldt State University provides the following relevant policy (source):
The Dean of Research, Economic and Community Development will serve as the RIO who will have primary responsibility for implementation of the institution’s policies and procedures on research misconduct.
and later it's specified that:
All University members will report observed or apparent research misconduct to the RIO. If an individual is unsure whether an incident falls within the definition of research misconduct, he or she may meet with or contact the RIO to discuss the suspected research misconduct informally, which may include discussing it anonymously and/or hypothetically. If the circumstances described by the individual do not meet the definition of research misconduct, the RIO will refer the individual or allegation to other offices or officials with responsibility for resolving the problem."
(RIO = Research Integrity Officer.)
Your University likely has a similar policy in place specifically for situations like this, and following the procedure in your University's policy is the best way to ensure your complaints are taken seriously.